#include <stdio.h>
#include <unistd.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <sys/reg.h>
#include <sys/types.h>
 
 
int main(int argc, char *argv[]){
 
    pid_t child;
    long orig_rax;
 
    child = fork();
 
    if(child == 0){
        ptrace(PTRACE_TRACEME, 0, NULL, NULL);  // Tell kernel, trace me
            execl("/bin/ls", "ls", NULL);
    }else{  
        /*Receive certification after child process stopped*/
        wait(NULL);
 
        /*Read child process's rax*/
        orig_rax = ptrace(PTRACE_PEEKUSER, child, 8*ORIG_RAX, NULL);
        printf("[+] The child made a system call %ld.\n", orig_rax);
 
        /*Continue*/
        ptrace(PTRACE_CONT, child, NULL, NULL);
        }
 
    return 0;
}